CVE-2025-59953: LMDeploy: unsafe pickle deserialization allows RCE

Q: Is CVE-2025-59953 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-59953, increasing the risk of exploitation.

Q: How to fix CVE-2025-59953?

1) Upgrade lmdeploy to 0.10.2 or later (pip install -U lmdeploy). 2) Inventory deployments running 0.9.1 to 0.10.1 with the RPC/ZMQ server enabled. 3) Restrict the RPC port with firewall rules, security groups or network policies so only trusted cluster nodes can connect, and never expose it to the internet. 4) Run inference containers as non-root with minimal credentials, read-only filesystems and egress filtering. 5) Detect: monitor for unexpected child processes spawned by the LMDeploy service, unusual outbound connections from GPU hosts, and inbound connections to the ZMQ port from unknown sources. 6) If exposure is suspected, rotate secrets and credentials available to the host and review model artifacts for tampering.

Q: What systems are affected by CVE-2025-59953?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference servers, distributed inference clusters, GPU-based ML infrastructure.

Q: What is the CVSS score for CVE-2025-59953?

CVE-2025-59953 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.88%.

GHSA-5h8j-6crg-7rmwCRITICALPoC AVAILABLECISA: ATTEND

Published September 16, 2026

CISO Take

LMDeploy's ZeroMQ-based RPC server (AsyncRPCServer) passes incoming messages straight to pickle.loads(), so any unauthenticated network client can execute arbitrary code on the inference host (CVSS 9.8, CWE-502). Exploitation is trivial because no authentication or user interaction is needed, although current signals are modest: EPSS is 0.8% (top 45%), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template, though CISA SSVC rates it ATTEND. Downstream blast radius is limited (1 dependent), but LMDeploy often runs on GPU servers holding model weights, API keys and cloud credentials, and the package has 11 other CVEs, which points to a weak security track record. Upgrade to lmdeploy 0.10.2 or later, and until then block network access to the RPC port from anything other than trusted nodes.

Sources:NVDEPSSGitHub AdvisoryATLASOpenSSF

What is the risk?

High. The flaw is network-reachable, needs no privileges or user interaction, and gives full code execution (C:H/I:H/A:H). Real-world likelihood is tempered by low EPSS, no public exploit and no KEV listing, and by the fact that the RPC server is typically used in multi-node or distributed deployments rather than on a default single-node setup. Pickle deserialization bugs are well understood, so weaponization is easy once an attacker can reach the port. Any deployment that exposes the ZMQ RPC endpoint beyond a trusted segment faces critical risk.

How does the attack unfold?

Initial Access

Attacker reaches the exposed LMDeploy ZMQ RPC port over the network without authentication.

AML.T0049

Exploitation

A malicious pickle payload is sent and deserialized by pickle.loads() in call_and_response(), executing attacker code.

AML.T0050

Collection

Attacker harvests model weights, API keys and cloud credentials from the inference host.

AML.T0035

Impact

Attacker moves laterally across the GPU cluster, tampers with model outputs or disrupts inference service availability.

Initial Access

Attacker reaches the exposed LMDeploy ZMQ RPC port over the network without authentication.

AML.T0049

Exploitation

A malicious pickle payload is sent and deserialized by pickle.loads() in call_and_response(), executing attacker code.

AML.T0050

Collection

Attacker harvests model weights, API keys and cloud credentials from the inference host.

AML.T0035

Impact

Attacker moves laterally across the GPU cluster, tampers with model outputs or disrupts inference service availability.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LMDeploy	pip	>= 0.9.1, < 0.10.2	`0.10.2`
8.1K1 dependentsPushed 4d ago46% patched~18d to patchFull package profile →

Do you use LMDeploy? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.9%

chance of exploitation in 30 days

Higher than 59% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade lmdeploy to 0.10.2 or later (pip install -U lmdeploy). 2) Inventory deployments running 0.9.1 to 0.10.1 with the RPC/ZMQ server enabled. 3) Restrict the RPC port with firewall rules, security groups or network policies so only trusted cluster nodes can connect, and never expose it to the internet. 4) Run inference containers as non-root with minimal credentials, read-only filesystems and egress filtering. 5) Detect: monitor for unexpected child processes spawned by the LMDeploy service, unusual outbound connections from GPU hosts, and inbound connections to the ZMQ port from unknown sources. 6) If exposure is suspected, rotate secrets and credentials available to the host and review model artifacts for tampering.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionSupply ChainInferenceFrameworkAML.T0035- AI Artifact Collection AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and mechanisms for deactivating AI systems

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2025-59953?

Is CVE-2025-59953 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-59953, increasing the risk of exploitation.

How to fix CVE-2025-59953?

1) Upgrade lmdeploy to 0.10.2 or later (pip install -U lmdeploy). 2) Inventory deployments running 0.9.1 to 0.10.1 with the RPC/ZMQ server enabled. 3) Restrict the RPC port with firewall rules, security groups or network policies so only trusted cluster nodes can connect, and never expose it to the internet. 4) Run inference containers as non-root with minimal credentials, read-only filesystems and egress filtering. 5) Detect: monitor for unexpected child processes spawned by the LMDeploy service, unusual outbound connections from GPU hosts, and inbound connections to the ZMQ port from unknown sources. 6) If exposure is suspected, rotate secrets and credentials available to the host and review model artifacts for tampering.

What systems are affected by CVE-2025-59953?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference servers, distributed inference clusters, GPU-based ML infrastructure.

What is the CVSS score for CVE-2025-59953?

CVE-2025-59953 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.88%.

What is the AI security impact?

Affected AI Architectures

model servingLLM inference serversdistributed inference clustersGPU-based ML infrastructure

MITRE ATLAS Techniques

AML.T0035AI Artifact Collection

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, the LMdeploy implements an rpc server (AsyncRPCServer in zmq_rpc.py) for supporting the RPC communications. In its core functionality call_and_response(), I found it will directly use the pickles.loads() to deserialize the received messages without any sanitization, hence resulting in a remote code execution vulnerability by this RPC server. Version 0.10.2 contains a patch.

Exploitation Scenario

An attacker scans for or reaches an internal or misconfigured LMDeploy node whose ZMQ RPC port is open. They send a crafted pickle payload whose __reduce__ method runs a shell command. The server deserializes it in call_and_response() and executes the command with the service's privileges. The attacker then installs a reverse shell, steals model weights and cloud credentials from the environment, and moves laterally to other GPU nodes or backend systems.

Weaknesses (CWE)

CWE-502Deserialization of Untrusted DataPrimary CWE-502Deserialization of Untrusted DataPrimary CWE-502Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.